753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494

Analysis

max time kernel
29s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.ea.game.pvz2_.apk
Size 4.0MB
Sample260930-lfxtbabf76
SHA256 753c3f4b3207b8476f6a680e64de5d0145563409323a33de7b8237570ca81494
MD5 af6f731cd1658877e5bb2c9e985d969a
SHA1 ef342f82fdb71ef841322c543a7a2080fb535bef
SHA512 1b735e97b6ef60083991336f0e1c2d2bf477286910bf7017825a514529b1411e9fd14d2a6510165c66cbd3948f2597a0cdf7dd0239f913101b45b27d0c9ada82
SSDEEP 98304:8JB/IQpnI/VV17GqIgi8Hz2ZmTRBxPQPAZgL4rj7:8V0hGbgi8TFPPL
TLSH
T12D16019AF74CA03FD97B643249BA5225A2974C034DC3AF833944761C29BB5845F6EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.ea.game.pvz2_
/data/local/bin/su	com.ea.game.pvz2_
/system/app/Superuser.apk	com.ea.game.pvz2_
/data/local/xbin/su	com.ea.game.pvz2_
/system/sd/xbin/su	com.ea.game.pvz2_
/system/bin/failsafe/su	com.ea.game.pvz2_
/data/local/su	com.ea.game.pvz2_
/system/xbin/su	com.ea.game.pvz2_
/sbin/su	com.ea.game.pvz2_

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xdcd6b000-0xdcd6de78	4291	com.ea.game.pvz2_
Anonymous-DexFile@0xbebe4000-0xbebea21c	4291	com.ea.game.pvz2_

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ea.game.pvz2_

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ea.game.pvz2_

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ea.game.pvz2_

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ea.game.pvz2_

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ea.game.pvz2_

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ea.game.pvz2_

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ea.game.pvz2_

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ea.game.pvz2_

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ea.game.pvz2_

com.ea.game.pvz2_
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4291

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db-journal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-journal
Size 512B
SHA256 e0ebc5afd799fb12ff859dfc86e3cdf8676ef4d4b8ae0c8d1a26688f1d34ff75
MD5 93262b4fd0bd30134bce32fa8dc4cf98
SHA1 b74be946f0a0bcf643dacf0d1c35591f4f8fe020
SHA512 f0b749f446331cf901a89588949313f959ca7e82a5cc964f43539934b1f68fb77a549358689b2cedb3237b18322d0ad07d283217e089dd525f97c7e5dcbbba17
MD5 SHA1 SHA512

Submit Download

OneSignal.db-wal

Path /data/data/com.ea.game.pvz2_/databases/OneSignal.db-wal
Size 64KB
SHA256 00427c7a317277c5ef38b8b983c58a4c7a4bf6cde744217efadc580bdf4fadb0
MD5 1a5b66c209bae312dd8e96e9512822d3
SHA1 1571346b84c2a76bdaf896325035a292e87cb98b
SHA512 2af00e8942f00d4c2e593a43b2e8573938e32ee0caf0df2e6f210ae7886e8b832ee34d8c014d5f622b79f38c676fb208c0983f5aa79a2ad31001dffce8c11574
SSDEEP 48:zkczNSP/6+kCyUCrQcrA0oJtqracrObMoOSP/jObs/iI:z50PPXeoDrbxrPrOw/d
TLSH
T12853ACEF578631D1DBC615B3105243F44E3BA10D8A9347A62BF668286E82F09D393C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 c934385c83b09a8e49290cf1d67c157482b96f4d5b1e85221ca92752b9e67ffc
MD5 b9964184895f457d69302645c656864c
SHA1 9a14753dc8dea5cec9c2b4215f134e355a91bcdd
SHA512 4b3d4da29d87bcc114a63b73952ecf283887a153311e8b35f2c7743a159b48b6a2942431c7fe1f88cf28167e6820e2e06e9dd7d581044f4787a63ee0b7a502b8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.ea.game.pvz2_/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 1dc2cf63f9e72503d277cc1a76127d3fc875807383d3c23fa758ce719a2e625e
MD5 b6a207f3ebe2cfd352d02a190440d61c
SHA1 0d426cbdc00d2748cbc9cad2a443cc9686006ce4
SHA512 da6992ef5ee82bb21e7f1ec5df90fe1fbd470c580301e2d276198f9eb71fbdd2477466a2af2e70fc8913a6d47e4d212583f24e60a00d12a9f7d727aff0994a1b
SSDEEP 48:hTzNSP/o1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/l6do8:50PBMEX0wIyNjaP96d3
TLSH
T14563415C1A281261C2BD143EE7F58B531A7CD3EF972787123DD84CE98CC686CF425954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 914e39a7dd7707df93c4d7c0b860cecaae42fba359559f3c9f80972bef536ea5
MD5 edbcd19d6404ba7d965fac52926c7c04
SHA1 5b1d11548cad9b6d00dd7bbb18e4c440955b8fd8
SHA512 904f70f34a8fbf298f85d831541bebf09099299676ff18f259bebd5aaf4c9ac3a011d957bd2f6b2d5a9f9ecc777f0edda8e201ad551f4f7c2bf266c7d9d34eb7
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmPNDdB2/KzMlklKllgIn:LCM+/lulvl61XtQlrf
TLSH
T1747292813295C702E5278335529B87F21831A2802E02821BB805A70C1C912D02A16217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 7de871af8be97dc79693c348ffefe2f29ecb33534df2ff4165a770a819959712
MD5 0c0e561c40ed69e823424105876748fe
SHA1 ba5d453beba491870c7f06d57481bd7bbe91de98
SHA512 bfa9e43b3972d3410a9f6fe4a6fbe3b2bb955157616bd08b2db18334db99c7d8d2812d17fd72a7fbe884b2dad93f047b0ca8435ad794fd6ec71ca881b03e7336
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlYQlr2ZCM+/lulvl61XtQlrf:rr/gW49blqYFlXg+/0Fl6NG7
TLSH
T17D725E9132A8C702FA274B3851DBD3D1243A71621B43C116B806AF0C1DC63D10525703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 8428c49c023bbccbbfc52ea40412b3f2e8d0ebf68956a11246bdaf4901e38c55
MD5 0eb93d97c1b9e8a0829a39ac74453c02
SHA1 3f1aac05384c8b69fed40b2cbd980fa64bd906dc
SHA512 9dcf8a2744bef119bfa1615705d3cba1e72781c8e89a2682388ad7408f094149ef5ae3616a0c83eaabb2ffa9f664838828b86684d458f3c7e980b1adf9e7ccfa
SSDEEP 12:7RhOLavnOAU7wU7UyWl09Q949blqYFlXg+/0Fl6NG7:VhKamNZ229u499FalFN
TLSH
T1677230D171B8D612F6734B38529BD6D2243A71921B13D253BC06AB0C1D813A24561707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 f9afe6b2f3cca3b7ce63174de59a71a8d57cc0f47f526d70c6ca5fe8c571cf92
MD5 1e7d36ee3646bee1eb99c2ed176d56a4
SHA1 0c201d2653b5cab5dadc3bc5efcb4dd9eb9429a0
SHA512 1f48c6324dcd638d88f9f7b2109d6a1483b032c53c0ae0d32b0aec434820c8fb93ad5f0850064c5a469e86eee47457e727d81fa099c5ab3085bc00aedb44888d
SSDEEP 12:WDRhOLavnOAU7wU7UyWl09Q949blqYFlXg+/0Fl6NGv:W9hKamNZ229u499FalFN
TLSH
T1207230D171B8DA12F6634B3C929BD6D2243E71921B13D213B806BF0C19413924172702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db
Size 16KB
SHA256 40c9c21d0ec1148af47bfe76bec6e0598764d3c1c8d4b4970162d1d807ec5d6a
MD5 3ebaf70191c2f2c89dc95298939a5500
SHA1 9b5cbd8cd117eae2e731be8371a9b4056b6b1090
SHA512 af3ef303667e197a7e5f8a1867ec47dad22236ae0feb3b25d58230afc26613624841294f6903393c6d0a1502de5019e1c682fe7514460faa90303f76e4d547e2
SSDEEP 3:o18vvHXGlXdl:o8mbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.ea.game.pvz2_/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 ce0a91674bb17927040fef0de82ee7b2ac45ab45e1f0d6b3e8ce24fa7735535b
MD5 387ce478a013a6d3a1968c06caa524ac
SHA1 4f7888d80721028a94da6880a64c3060ddae04ab
SHA512 2def1d92de945cf2ebe2e60ebabbd8ef8452c7db4bf184a822ac8e677e39f56295a4c6d48d869c7ebd2cad8da747fe46e9f3129c79afbe9f648a1f79cb54af60
MD5 SHA1 SHA512

Submit Download